Frappe vulnerabilities
266 CVEs and advisories name Frappe as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-31877Frappe SQL Injection due to improper field sanitization
- CVE-2026-29081Frappe: Possibility of SQL Injection due to improper fieldname sanitization
- CVE-2026-29077Frappe: Broken Access Control in DocShare
- CVE-2026-28436Frappe: Stored XSS in avatar_macro.html
- CVE-2026-27471ERP: Document access through endpoints due to missing validation
- CVE-2026-26977Frappe Learning Management System exposes details of unpublished courses to unauthorized users
- CVE-2026-26031Frappe LMS affected by unauthorised user was able to access the full list of batch enrolled students
- CVE-2026-25956Frappe Affected by XSS and Open Redirect in Sign Up
- CVE-2026-23497Frappe LMS has a Stored XSS via Unsanitized Image Filename in Course and Jobs Pages
- CVE-2025-68953Certain Frappe requests are vulnerable to Path Traversal
- CVE-2025-68929Frappe may be vulnerable remote code execution due to server-side template injection
- CVE-2025-68928Frappe CRM vulnerable to authenticated XSS via website field
- CVE-2025-67734Frappe Authenticated Users can Execute JavaScript through its Job Form
- CVE-2025-67730Frappe authenticated users can execute XSS through form description fields
- CVE-2025-10655Frappe Helpdesk 1.14.0 — SQL Injection in dashboard get_dashboard_data
- CVE-2025-66581Frappe LMS is Missing Server-Side Authorization in Business Logic
- CVE-2025-66206Frappe vulnerable to a path traversal allowing reading certain files
- CVE-2025-66205Frappe has the possibility of SQL Injection due to improper validations
- CVE-2025-11461Frappe CRM 1.53.1 — Multiple SQL Injections in Dashboard Controller
- CVE-2025-64707Frappe LMS revoking access did not show immediate effect as roles were cached
- CVE-2025-64705Frappe user was able to access the submission of other students
- CVE-2025-62779Frappe Learning users were able to add HTML through input fields in the Job Form
- CVE-2025-62778Frappe Learning allowed students to access the Quiz Form via direct URL
- CVE-2025-62407Frappe has an Open Redirect on Login Page
- CVE-2025-62158Frappe had attachments made by students to their assignments of type Text set to public
- CVE-2025-11283Frappe LMS Course cross site scripting
- CVE-2025-11282Frappe LMS Incomplete Fix CVE-2025-55006 cross site scripting
- CVE-2025-11281Frappe LMS Unpublished Course courses access control
- CVE-2025-11280Frappe LMS Assignment Picture files direct request
- CVE-2025-59421Press vulnerable to email flooding to users due to lack of validation and rate limits